Releases: mendersoftware/mender-artifact
v4.2.0
4.2.0 - 2025-10-15
Features
-
Optionally warn or fail on large Artifact sizes
(MEN-8567) (5f23818) by @lluiscamposThe
writecommands can now warn or fail when creating Artifacts bigger
than a certain size. This feature is meant to be used with upcoming
Mender Tier plans, which may set up limits on the Artifact size.The behaviour can be controlled with the flags:
--warn-artifact-sizeto soft warn on Artifacts larger than the limit--max-artifact-sizeto hard fail on Artifacts larger than the limit
Note that the limits are not enforced when streaming to stdout output,
nor on other commands that may increase the Artifact size likemodify,
cporinstall.
Build
-
Fix
make testtarget
(41c96f0) by @lluiscamposThe well-intended commit ba669f0 broke
make testwhen improving
themake coveragetarget :)
v4.1.1
4.1.1 - 2025-09-17
Bug fixes
-
Call show-provides with sudo
(MEN-8382) (f92cc16) by @michalkopczan -
Add validation rules for validating string parameters
(MEN-8513) (ddd821f) by @alfrunesArtifact name and group must no more than 256 characters and contain
printable characters. Only characters from the following Unicode
categories are allowed: L, M, N, P, S and ASCII white space.Creating artifact violating these conditions will result in an error.
Reading an existing artifact will print a warning. -
Mender-artifact hangs when ssh connection fails silently
(MEN-8429) (9db4a2b) by @michalkopczan -
Mender-artifact does not reenable echo on ssh error
(MEN-8428) (15921d6) by @michalkopczanOriginal idea was to handle reenabling echo thanks to EchoSigHandler, but it was failing sometimes.
The issue was that EchoSigHandler, when finishing its execution, sends an error to errChan. We need
to wait on errChan until we get something on it - meaning that the EchoSigHandler finished,
and we can safely exit the application.However, before my changes, if there was an error returned before reaching
if s.sigChan != nil { signal.Stop(s.sigChan) s.cancel() if err := <-s.errChan; err != nil { return err } }So, for example, here:
_, err = recvSnapshot(f, command.Stdout) if err != nil { _ = command.Cmd.Process.Kill() return "", err }Then we never waitied on errChan. Application was closed, EchoSigHandler never got the chance to
reenable echo (sometimes it did, sometimes it didn't), and we were left with echo disabled.Adding a separate function that waits for errChan, and deferring it, we have the problem solved.
-
Split token into fixed number of parts
(SEC-1676) (0cce29b) by @lluiscamposFixes CVE-2025-22868. Fix ported from
https://go-review.googlesource.com/c/oauth2/+/652155
Documentation
- Make current support for only one payload in artifact v3 explicit in the documentation
(MEN-8588) (879f89d) by @michalkopczan